How to Set Up SPF for AWS Simple Email Service (SES)

Setting up Sender Policy Framework (SPF) for Amazon Simple Email Service (SES) is essential to ensure your outgoing emails are authenticated and reach the inbox rather than the spam folder. Because AWS SES operates across multiple geographic regions and handles the envelope sender domain on your behalf, your SPF configuration must precisely mirror Amazon's requirements to prevent delivery failures.

To simplify the creation of your custom mail-from domain and associated DNS records, you can use the SPF Record Generator to automatically build and validate your syntax without syntax errors.

Understanding AWS SES SPF Architecture

Unlike traditional self-hosted mail servers where your SPF record points directly to your own server IP addresses, AWS SES relies on a delegated architecture. When you send an email through SES, you are technically sending it through Amazon's infrastructure. Consequently, your DNS must explicitly authorize Amazon to send email on your behalf.

Depending on whether you use the default amazonses.com domain or a Custom MAIL FROM domain, your SPF mechanism changes. If you use the default setup, Amazon handles the SPF alignment automatically using their infrastructure. However, if you want your emails to display your own domain in the "Return-Path" address, you must configure a Custom MAIL FROM domain and publish specific DNS records.

The Mechanics of AWS SES SPF Inclusion

Amazon SES requires you to include their regional SPF include mechanism in your domain's TXT record. The specific include statement depends on the AWS region where you are operating your SES service. For example, if your SES endpoint is in US East (N. Virginia), your include statement points to amazonses.com.

Here is how standard regional include strings look:

• US East (N. Virginia) us-east-1: include:amazonses.com
• EU (Ireland) eu-west-1: include:eu-west-1.amazonses.com
• Asia Pacific (Tokyo) ap-northeast-1: include:ap-northeast-1.amazonses.com

Step-by-Step AWS SES SPF Record Setup

Follow these steps to configure your custom MAIL FROM domain and complete your AWS SES SPF record setup correctly.

Step 1: Request a Custom MAIL FROM Domain in AWS Console

1. Log into the AWS Management Console and open the Amazon SES console. Ensure you are in the correct AWS region.
2. In the left navigation pane, click on Verified identities and select your domain.
3. Scroll down to the MAIL FROM domain section and click Edit.
4. Enter your desired subdomain, such as mail.example.com or bounce.example.com.
5. Select your preferred behavior for MX failure (e.g., Use fallback value amazonses.com).
6. Click Save changes.

Step 2: Publish the MX Record

AWS SES requires an MX record for your custom MAIL FROM domain to handle bounced emails and complaints. After saving your MAIL FROM domain in Step 1, AWS will provide the required MX record values.

Log into your DNS provider (such as Route 53, Cloudflare, or GoDaddy) and add the following record:

• Type: MX
• Host / Name: mail.example.com (or your chosen subdomain)
• Value: feedback-smtp.us-east-1.amazonses.com (adjust region as needed)
• Priority: 10

Step 3: Publish the SPF TXT Record

Next, you need to publish the SPF TXT record for your custom MAIL FROM subdomain. This tells receiving mail servers that Amazon is authorized to send mail from this specific subdomain.

• Type: TXT
• Host / Name: mail.example.com
• Value: v=spf1 include:amazonses.com ~all

If you also send emails from your root domain (e.g., example.com) using other services like Google Workspace or Microsoft 365, your root domain TXT record will look slightly different:

v=spf1 include:_spf.google.com include:amazonses.com ~all

Step 4: Verify DNS Configuration

DNS propagation can take anywhere from a few minutes to a few hours. Once published, return to the AWS SES console and check the verification status of your MAIL FROM domain. You can also verify your DNS records locally using command-line tools.

Using dig on Linux or macOS:

dig TXT mail.example.com +short

Using PowerShell on Windows:

Resolve-DnsName -Name mail.example.com -Type TXT

Expected output sample:

"v=spf1 include:amazonses.com ~all"

Comparing SPF Implementations for AWS SES

Configuration Type	Record Host	Record Value Example	Use Case
Default SES Domain	None (AWS Managed)	Managed by AWS	Quick testing, no custom bounce handling required.
Custom MAIL FROM	mail.example.com	v=spf1 include:amazonses.com ~all	Professional branding, DMARC alignment, custom bounce handling.
Root Domain SPF	example.com	v=spf1 include:_spf.google.com include:amazonses.com ~all	When sending transactional mail from SES and corporate mail from another provider.

Common Mistakes and How to Fix Them

Even experienced engineers occasionally run into configuration pitfalls when dealing with AWS SES and SPF.

1. Exceeding the 10-DNS-Lookup Limit

The SPF specification limits the number of mechanism lookups (like include, a, mx, ptr) to a maximum of 10. If your root domain record includes too many third-party services alongside AWS SES, mail servers will return a permerror.

• Fix: Consolidate your includes or use an SPF flattening service if necessary, ensuring include:amazonses.com is preserved.

2. Creating Multiple SPF Records on a Single Domain

A domain or subdomain must never have more than one SPF TXT record. If you publish two separate TXT records starting with v=spf1, receiving mail servers will invalidate both records entirely, causing your authentication to fail.

• Fix: Combine all authorized service providers into a single TXT record string.

3. Mismatching AWS Regions

If your SES sending resources reside in eu-west-1 (Ireland), but your SPF record uses include:amazonses.com (which points to US East), SPF validation may fail or result in alignment issues depending on how strict the receiving server is.

• Fix: Always match the regional include tag with the exact AWS region where your SES identities are configured.

Quick Setup Checklist

• Requested a Custom MAIL FROM domain inside the AWS SES console.
• Configured the required MX record with the correct regional SES endpoint.
• Created a single TXT record for the MAIL FROM subdomain containing v=spf1 include:amazonses.com ~all.
• Verified that no duplicate SPF records exist on the target subdomain.
• Tested DNS propagation using dig or nslookup.
• Confirmed successful status verification in the AWS SES dashboard.